Joseph Rowntree School (health check) City of York Council Internal Audit Report 2015/16

Business Unit: Secondary Schools, Headteacher: R Crane Date Issued: 19/05/16 Status: Final Reference: 15661/006

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction This audit was carried out on Wednesday 2nd December and Thursday 3rd December 2015 as part of the Internal Audit plan for Education, Skills and Children’s Services for 2015/16.

Objectives and Scope of the Audit The purpose of this audit was to provide advice to the Governors, Head Teacher and the Authority’s Section 151 Officer about the financial management procedures and assurance that internal controls of the school were operating effectively to manage key risks, both financial and otherwise.

The audit consisted of a “health check” incorporating, a follow up of agreed actions from the last report, a review of any significant changes in finance and governance systems since the last audit, and some limited testing covering the areas below:

- Governance;
- Financial Management;
- System Reconciliation;
- Contracts – Ordering, Purchasing and Authorisation;
- Income;
- Capital and Property;
- Human Resources;
- Payroll;
- School Meals; and
- Security.

Key Findings The key findings in the audit related to completion of financial benchmarking, evidencing review of ongoing contractual arrangements, ensuring there is adequate evidence to confirm quotation or tendering exercises have been conducted in a fair and transparent manner, prompt follow up of outstanding debts and ensuring that data required to be made available under the publication scheme is notified to the public and available from the school.

Overall Conclusions It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance.

## 1 Register of Interests

| Issue/Control Weakness | Risk | |------------------------|------| | Declarations of interest for the current year were not on file for two recent Governors. Additionally some declarations did not clearly state the nature of the interest declared. | Governors may be in a position to influence the placing of contracts in which they have a personal interest. The school may be unable to fully account for purchasing decisions in the event of challenge. |

### Findings

The register of interests for Governors had been renewed September 2015 and for staff in November 2015. Two Governors joined the Governing Body in September and October. No declarations were as yet in place. A review of the declarations highlighted that in three cases Governors declarations recorded the company or organisation in which the interest was held, but not the nature of the interest.

### Recommendation

The school should ensure that all new Governors have a declaration of interests in place. All declarations should clearly state the nature of the interest as well as the name of the relevant organisation. Governor details and pecuniary interests should be published on the schools website in accordance with statutory guidance.

### Agreed Action 1.1

The Business Manager addressed this at the Full Governing body (FGB) meeting on 25th January. The Clerk to the Governors is aware of this and all future declarations will clearly state the nature of the interest as well as the interest itself.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business Manager | Complete | 2 Benchmarking

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | There has been no recent financial benchmarking exercise at the school. | Spend may not be effectively targeted, savings may not be identified, and value for money may not be achieved. |

Findings

Completion of financial benchmarking has been identified in the school’s Financial Value Standard each year as not having been completed. There has been no recent benchmarking or comparative exercise to identify whether there are particular areas of spend where the school may be challenged and could potentially make savings.

Recommendation

A financial benchmarking exercise should be completed for the school. The results should be presented to the Governors and an action plan agreed to address any identified issues.

Agreed Action 2.1

An updated report was taken to FGB on 25th January 2016. The Business Manager is planning to take an update to this to the FGB meeting scheduled for 4th July 2016 and then to repeat the exercise every six months. Each report will contain recommendation of any actions required to improve the financial performance of the school.

| Priority | Responsible Officer | Timescale | |----------|---------------------|---------------| | 3 | School Business Manager | 31 July 2016 | 3 Contracts, Ordering, Purchasing and Authorisation

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | For quotation or tender exercises over 5K the school was unable to evidence that all quotations or tenders evaluated were received and opened at the same time and that the evaluation if other than lowest price was completed by more than one officer. | In the event of challenge the school may be unable to evidence that the contract has been awarded in a fair and transparent manner, in compliance with the Council’s Financial regulations and Contract Procurement Rules. |

Findings

Two recent procurements were reviewed, the first being for new printers (29K) and the second for the ground maintenance (3 yr contract at 16K/annum). In both cases the contracts were awarded on the basis of “most advantageous tender” (MEAT). It was noted that although assurance was given that all quotations received were opened at the same time after the notified closing date, they were opened by one officer and no record maintained. Additionally, although more than one officer was involved in evaluating the submissions no evidence of this had been retained.

Recommendation

All tenders or quotations received should be held securely prior to opening and should be opened in the presence of two officers. The time of opening and the tender values should be recorded and the record signed by both officers. The scoring for tender evaluation should be completed by more than one officer and each evaluation signed and retained. If the evaluation is completed jointly then this should be signed by both officers.

Agreed Action 3.1

The Auditor provided the Business Manager with the relevant forms. These are being used in the current tender for the catering contract with the school and will be used as required in the future.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business Manager | Complete | 4 Contract Review

| Issue/Control Weakness | Risk | |------------------------|------| | The school cannot evidence that on-going contracts are periodically reviewed contract review and some arrangements have not been tendered or market tested for a number of years. Additionally, checks on contractors public liability insurance and Health & Safety Registration (where applicable) may not be up to date. | The school may not be achieving “best value “in their on-going contracts and contractors may not be complying with the Councils Health & Safety and insurance requirements. |

Findings

Assurance was given by the School Business Manager that the schools on-going contracts are currently being reviewed and retendering or market testing planned where necessary. It was noted that the school catering contractor had been in place for 5 years and the contract extended on a rolling basis from February 2015. It is understood this will be retendered next year. There is currently no complete record of all on-going contractual arrangements at the school with associated costs and date they were last reviewed or re-tendered. Additionally, it was acknowledged that verification of contractor’s public liability insurance and Health & Safety Registration may be out of date for those contractors providing continuing services at the school.

Recommendation

It is recommended that a schedule of all on-going service contracts and contractual arrangements is maintained and reviewed on an annual basis to ensure that re-tender or market testing is planned effectively. Evidence of review should be retained eg Finance committee minute. Re-tender of significant contracts (eg catering contract) should be progressed. It is also recommended that checks on contractors public liability insurance and Health & Safety registration where applicable are kept up to date.

Agreed Action 4.1

The Business Manager will generate a Contract Review Schedule for any contracts not already covered on the care package currently in place with the City of York Council. We always obtain Insurance and Health and Safety certificates for new contracts but we will put in place a mechanism to review these on at least an annual basis.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business Manager | 31 July 2016 | 5 Income

| Issue/Control Weakness | Risk | |------------------------|------| | There were a number of lettings invoices that are significantly overdue for payment. | All income due may not be collected |

Findings

Invoices raised for lettings that were overdue for payment had not been promptly followed up. A review of outstanding debtors and follow up had been completed at the school in November 2015 and at that point approximately £14.5k of overdue charges was outstanding. As a consequence hirers had continued to use the facilities for a significant time after the last period paid for and problems may be encountered by the hirers in catching up with these payments. Audit was informed that the follow up process for overdue invoices had not been correctly applied mainly due to pressures of implementing the new Financial Management System.

Recommendation

The school should ensure outstanding charges are chased up promptly.

Agreed Action 5.1

All outstanding invoices have now been dealt with and new terms of reference were issued to all current lettings in September 2015 – this details the following conditions:

- Any casual bookings must be paid for in full before using the facilities.
- Invoices for regular bookings must be paid according to the terms stated on the invoice, except in circumstances approved by the school in advance of using the facilities.

These conditions will now be rigorously enforced. 6 Freedom of Information

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The Publication Scheme’s guide to information schedule adopted by the school does not include all categories that the Information Commissioner expects schools to provide. | The school may not be complying fully with the requirements under the Data Protection Act (DPA), Environmental Regulations (EIR) and Freedom of Information Act (FOIA) and statutory requirements may be breached. |

Findings

The school has adopted the Information Commissioners Model Publication Scheme with the separate guide to information schedule, (which details where information relating to the school can be obtained and any related charges). A template guide is available and guidance on expected categories of information to be made available on the Information Commissioners web site. The schools guide to information does not cover all the required categories. The Publication Scheme along with the guide is not included on the schools website.

Recommendation

The Information Commissioners Model Publication Scheme for Schools including the guide to information can be obtained from the ICO website. The current template documents have been sent to the school. The scheme should be adopted in full, unedited and promoted alongside the guide to information which should include all the categories of information the Information Commissioner expects schools to provide. The approved Publication Scheme and guide to information schedule should be made available by publishing on the schools website.

Agreed Action 6.1

The Auditor provided the Business Manager with the up-to-date requirements and these have now been incorporated into a revision of the school’s Freedom of Information Publication Scheme which was approved by Governors at the FGB meeting on 21st March 2016.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business Manager | Complete | 7 Data Security

| Issue/Control Weakness | Risk | |------------------------|------| | Unencrypted personal data may be held on laptops and data sticks. | Statutory requirements may be breached. The ICO has powers to levy fines of up to £500,000 for the most serious breaches of the data protection act. |

Findings

Laptops made available for teachers to borrow are not encrypted and data sticks are not encrypted. The ICT Manager gave assurances that laptops are periodically wiped (every school holiday) and staff are aware that no personal or sensitive data should be held on an unencrypted device. Staff working on laptops can connect remotely through a schools portal. However, it is possible that sensitive documents could be held on the hard drive or a USB stick.

Recommendation

The school should consider whether portable devices which store data such as laptops and memory sticks should be encrypted to protect any personal data which may be held. The Information Commissioners website has the latest advice on data security and the advice on encryption has been sent to the school.

Agreed Action 7.1

The Governors approved the School Data Protection Policy at the FGB on 23rd November 2015. Staff have been reminded that no personal data on staff or students should be removed from site. Laptops are wiped at the end of each school term. We will look into the practicality of encryption for the situations that we have at school.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business Manager | 31 July 2016 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.